The First Conversation
Ten minutes that determine whether this becomes a process. Most matters should end here and most organisations do not have this conversation at all.
Investigation of breaches
Unenforceable
As written
Breaches of this policy may be investigated and may result in disciplinary action.
What happens
Jumps directly from breach to investigation, with nothing in between.
In practice most matters are resolved by a manager mentioning it, which the clause does not describe and does not authorise.
The missing step is the one that handles almost everything.
Something has come to light. The policy describes investigation and discipline. The thing that actually resolves most matters is a short conversation that appears nowhere in the document.
The response process in “The First Conversation” needs evidence that can be checked without turning one signal into a conclusion. If time tracking software with accountable controls supports time tracking software, managers should validate the record with the person involved, preserve the correction history and distinguish an operational exception from deliberate misconduct before any consequential action.
What it is
A manager saying: I noticed this, can you tell me what happened.
For a separate benchmark relevant to “The First Conversation”, consult the WIRED security coverage. Use it to test purpose, notice, permissions, retention and response procedures against the proposed operating model rather than treating a generic checklist as proof that the rule works.
Ten minutes, not minuted, not a process, and genuinely open to the answer.
Why it resolves most things
Because most breaches have an explanation that makes the whole matter unnecessary.
They were covering for somebody on leave and needed the access. The approved tool could not open the file. They did not know the rule existed. The thing they did was authorised by somebody who did not record it.
Each of those ends the matter, and each takes one question to establish.
What it requires
That the manager asks before concluding. The commonest failure is arriving with a view and seeking confirmation.
That it is not minuted, at this stage. A conversation that is being recorded is a process, and the person will respond to it as one.
And that the manager can actually end it. If every conversation has to be escalated, nobody will have the conversation.
What to record afterwards
For most: nothing, or a line in the manager's own notes.
For anything where the explanation was unsatisfactory, or where the same thing has happened before: a short note with the date and what was said, because the consistency question later turns on whether this was a first instance.
That distinction — nothing for the ordinary case, a note where it may recur — is the whole of the record-keeping and it is rarely stated.
When to skip it
Where the conduct is serious enough that a conversation would prejudice an investigation, or where somebody else is at risk.
Those are a small minority and they are identifiable. Treating every matter as though it might be one of them is what produces the process-first reflex.
What the policy should say about it
That most matters are resolved informally by a manager, and that this is the expected route rather than a lesser one.
Saying it has two effects: managers feel authorised to have the conversation, and staff know that a question from a manager is a question rather than the opening of a file.
Why it must not be minuted
A conversation being recorded is a process, and the person responds to it as one. The informal step only works while it is genuinely informal, which means the manager needs authority to end it.
What to record, and when
Nothing for the ordinary case. A dated line where the explanation was unsatisfactory or where the same thing has happened before, because the consistency question later turns on whether this was a first instance.
Why most matters end here
Because most breaches have an explanation that makes the whole thing unnecessary: covering for somebody on leave, a file the approved tool could not open, a rule nobody mentioned. One question establishes it.
The step that is missing from every document
Policies describe investigation and discipline. The thing that resolves most matters is a manager asking what happened, and it appears in no policy, which means managers either escalate everything or handle everything unofficially.
Naming the informal conversation as a legitimate and expected step stops both. It authorises the manager and it tells staff that a question is a question rather than the opening of a file, and that second effect is worth more than the first.
Where an organisation's policy jumps from breach to investigation, managers either escalate everything or handle everything unofficially. Naming the informal conversation as a legitimate step is what stops both.